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Amendments to the Specification; 

Please replace the paragraph beginning at page 11, line 31 
to line 34, with the following rewritten paragraph: 

In one embodiment, the user of host computer system 102 is 
given a set of choices on the protective action to be taken in 
TAKE PROTECTIVE ACTION OPERATION OPERATION 224 (or whether no 
protective action is to be taken) . 

Please replace the paragraph beginning at page 20, line 18 
to line 25, with the following rewritten paragraph: 

FIG. 5 is a diagram of a hooked operating system function 
call flow 500 in accordance with one embodiment of the present 
invention. Referring now to FIGS. 2 and 5 together, a hook 
module 506 is used to hook calls to a critical OS function 508. 

In one embodiment, HOOK CRITICAL OS FUNCTION (S) OPERATION 206 
is implemented using hook module 506, which is part of Return- 
to-LIBC attack detection application 106 (FIG. 1) . 
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Please replace the paragraph beginning at page 30, line 26 
to page 31, line 7, with the following rewritten paragraph: 

In view of this disclosure, the Return-to-LIBC attack 
detection functionality in accordance with one embodiment of 
the present invention can be implemented in a wide variety of 
computer system configurations. In addition, the Return-to- 
LIBC attack detection functionality could be stored as 
different modules in memories of different devices. For 
example, Return-to-LIBC attack detection application 106 could 
initially be stored in server system 13 0, and then as 
necessary, a portion of Return-to-LIBC attack detection 
application 106 could be transferred to host computer 
system 102 and executed on host computer system 102. 
Consequently, part of the Return-to-LIBC attack detection 
functionality would be executed on processor 134 of server 
system 13 0, and another part would be executed on processor 108 
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of host computer system 102. In view of this disclosure, those 
of skill in the art can implement various embodiments of the 
present invention in a wide -variety of physical hardware 
configurations using an operating system and computer 
programming language of interest to the user. 



GUNNISON, McKAY & 

HODGSON, L.L.P. 
Garden West Office Plaza 
1900 Garden Road, Suite 220 
Monterey, CA 93940 

(831)655-0880 
Fax (831)655-0888 



Page 3 of 12 



